AG04:2026 — Agentic Supply Chain Vulnerabilities

Slide 3 · The Definition Part 1

The official definition — what gets compromised and how it gets in

OWASP identifies both static and dynamic attack surfaces. Let's break them apart.

📄 OWASP Top 10 for Agentic Applications 2026 · ASI04

"Agentic Supply Chain Vulnerabilities arise when agents, tools, and related artifacts they work with are provided by third parties and may be malicious, compromised, or tampered with in transit."

What can be compromised — the full list

OWASP calls out both static and dynamic components:

Static (set at build/deploy time): models and model weights, base tools and plugins, datasets used for training or RAG, other agents bundled at deployment, agentic interfaces like MCP servers, package registries and their artifacts.

Dynamic (loaded at runtime): tools and plugins discovered and loaded while the agent is running, prompt templates pulled from external sources, agent personas loaded dynamically, MCP server connections made mid-session, agent-to-agent connections in live pipelines, update channels that push new capabilities to running agents.

Three ways components can be malicious

Malicious by design: an attacker deliberately creates a tool, plugin, or agent that appears legitimate but has hidden malicious behavior. The Postmark MCP impersonator (Scenario 03) is a real example — a fake MCP server published to npm that secretly BCC'd emails to the attacker.

Compromised after the fact: a legitimate component is hijacked — its registry entry, signing key, or update channel is taken over and a malicious version is substituted. The Amazon Q VS Code incident is an example.

Tampered with in transit: a legitimate component is intercepted and modified between its origin and the agent. This is an agent-in-the-middle attack on the supply chain itself.

← Back The live supply chain — why runtime matters →